Microsoft Teams

Overview

The Microsoft Teams integration reads your tenant’s Teams data from Microsoft Graph through a Microsoft Entra ID app registration. G360 then shows it on the Teams Metrics dashboard: adoption, active and inactive users, collaboration, meeting load, call quality, team activity, licence use, and cost savings. Setup takes about 15 minutes and has six steps:

Register an app in Microsoft Entra ID
Create a client secret
Add the Microsoft Graph permissions and grant admin consent
Show real names in Microsoft 365 reports
Add the connection in G360
Check that data arrives

This page covers Teams analytics. To send G360 reports and alerts to Teams, see Microsoft Teams notifications.

Before you start

You need:

A Microsoft 365 tenant with Microsoft Teams licences.
A Microsoft Entra account that can create app registrations and grant tenant-wide admin consent (for example a Global Administrator, or a Privileged Role Administrator plus an Application Administrator).
Access to the Microsoft 365 admin center (for step 4).
Access to G360 as an administrator.

Keep a text editor open. You will copy three values from Microsoft Entra ID (the tenant ID, the client ID, and the client secret) and paste them into G360 in step 5.

Step 1: Register an app in Microsoft Entra ID

Open App registrations

Start a new registration

Click New registration.

Name the app

In Name, type a name you will recognise, for example G360 Teams.

Pick the account type

Under Supported account types, select Accounts in this organizational directory only (Single tenant).

Leave Redirect URI empty and click Register.

Copy the IDs

On the app’s Overview page, copy:

Directory (tenant) ID: this is the Tenant ID.
Application (client) ID: this is the Client ID.

Write down: the Tenant ID and the Client ID.

Step 2: Create a client secret

Open Certificates & secrets

In the app registration, click Certificates & secrets.

Start a new secret

Under Client secrets, click New client secret.

Describe the secret

Enter a description, for example G360, and pick an expiry period. Click Add.

Copy the value

Copy the secret’s Value straight away.

Write down: the secret Value.

Copy the Value, not the Secret ID. Microsoft shows the value only once. If you leave the page without copying it, delete the secret and create a new one. Set a reminder to replace the secret before it expires; G360 cannot sync after that date.

Step 3: Add the Microsoft Graph permissions

Open Application permissions

In the app registration, click API permissions → Add a permission → Microsoft Graph → Application permissions (not Delegated permissions).

Add the permissions

Search for and tick each permission below, then click Add permissions.

Grant admin consent

Click Grant admin consent for <your organization> and confirm. Every permission must show a green Granted tick.

Permission	What G360 uses it for	Needed
`Reports.Read.All`	Teams usage reports: daily activity, meetings, calls, devices, team activity	Required
`User.Read.All`	Users and their licences	Required
`Organization.Read.All`	Licence plans and seat counts (Licensed users, cost savings)	Recommended
`CallRecords.Read.All`	Calls and call quality	Recommended
`Team.ReadBasic.All`	The list of teams	Recommended
`TeamMember.Read.All`	Team members (the avg teams per active engineer signal)	Recommended
`Channel.ReadBasic.All`	Channels	Recommended
`ChannelMember.Read.All`	Members of private and shared channels	Recommended
`Chat.Read.All`	Chats (metadata only, see below)	Recommended
`ChannelMessage.Read.All`	Channel messages (metadata only)	Recommended
`OnlineMeetings.Read.All`, `OnlineMeetingArtifact.Read.All`	Meetings and attendance reports, kept for future views; also need step 3b	Optional

Without a recommended permission, G360 still syncs; it skips only that data and the connection test lists what is missing and what it unlocks.
G360 never stores message, chat, or call-feedback text. It keeps only counts, times, and lengths.
G360 does not use Calendars.Read, Presence.Read.All, or Directory.Read.All. You do not need to grant them.

Step 3b (optional): meeting access policy

Microsoft requires a Teams application access policy before an app can read online meetings, even with the permissions above. No dashboard view uses meeting details yet, so you can skip this. To allow it, a Teams administrator runs once in PowerShell (replace the client ID):

Install-Module MicrosoftTeams          # only if it is not installed
Connect-MicrosoftTeams
New-CsApplicationAccessPolicy -Identity "G360-Meetings" -AppIds "<client id>" -Description "G360 meeting read"
Grant-CsApplicationAccessPolicy -PolicyName "G360-Meetings" -Global

It can take up to 30 minutes to apply. Without it, G360 skips meeting details and the rest of the sync is unaffected.

Step 4: Show real names in Microsoft 365 reports

By default Microsoft hides user names in its usage reports. G360 then cannot match activity to people.

Open the Microsoft 365 admin center

Open the Microsoft 365 admin center.

Open report settings

Go to Settings → Org settings → Services → Reports.

Show real names

Clear the box Display concealed user, group, and site names in all reports, then click Save.

If this box stays ticked, per-person figures (daily active users, most active and inactive users, collaboration) cannot be matched to people. The change can take a few hours to reach Microsoft’s reports.

Step 5: Add the connection in G360

Open the Microsoft Teams integration

In G360, click Integrations. On the Communication tab (or All), find the Microsoft Teams card and click Connect (or Manage if a Teams connection already exists).

Start a new connection

On Microsoft Teams Connections, click Add Connection. The Manage Connections: Microsoft Teams dialog opens.

Fill in the fields

Field	What to enter
Connection Name	A name you will recognise, for example `Acme Teams`. It must be unique.
Tenant ID	The Directory (tenant) ID from step 1.
Client ID	The Application (client) ID from step 1.
Client Secret	The secret Value from step 2. Click the eye icon to check you pasted all of it.

Test the connection

Click Test Connection.

You should see Connection test successful. If optional permissions are missing, the message says how many, and their data will be skipped.
If you see an error, go to Troubleshooting, fix it, and test again.

Save the connection

Click Save Connection.

You should see the connection on Microsoft Teams Connections. G360 creates a project for it, starts the first sync straight away, and then syncs daily at 12:00 AM IST.

Step 6: Check that data arrives

Wait for the first sync

The first sync reads the last 28 days. It takes from a few minutes for a small tenant to about an hour for a large one, because channel messages are read for the first time.

Open the dashboard

Open the Teams Metrics dashboard and pick the connection’s project in the Project filter.

You should see users, licences, and teams at once, and activity up to about two days ago.

Microsoft publishes its Teams usage reports 24 to 48 hours late, so activity figures always run about two days behind. Licences, teams, and members are as of the last sync.
Microsoft keeps day-by-day usage and call records for only about 28–30 days, which is why a Teams project’s time range is fixed at the last 28 days.

The Microsoft Teams Connections page

Column	Shows
Connection Name	The connection’s name.
Is Active	Active for every saved connection.
Last Updated	When the connection was last saved.
Actions	Edit or delete.

Edit a connection

Open the connection

On Microsoft Teams Connections, click the Edit icon on the connection’s row. The Edit Connections: Microsoft Teams dialog opens. The client secret is shown masked; leave it as it is to keep the current secret.

Save your changes

Change what you need, click Test Connection, then Update Connection and confirm.

Renaming changes nothing else.
A new client secret or client ID for the same tenant keeps all data.
A different tenant ID removes the old tenant’s data from the dashboards; the next sync loads the new tenant.
If a sync of this connection is running, the save is refused. Wait a few minutes and try again.

Delete a connection

Delete the linked project

If the connection is linked to a project, delete that project first in Projects. Deleting a connection that is still linked is refused with Unlink the project first.

Delete the connection

On Microsoft Teams Connections, click the Delete icon on the connection’s row and confirm.

G360 stops syncing the tenant and removes its Teams data from the dashboards.
Its sync schedule is stopped. Its run history is kept.
If a sync of this connection is running, the delete is refused. Wait a few minutes and try again.

How syncing works

Each sync reads every Teams source the app has permission for, then loads it into the dashboards. A source without permission is skipped, not failed.
Daily syncs read only what changed since the last one (new chats and channel messages, missing report days), so they are quicker than the first.
If Microsoft rate-limits G360, the sync keeps what it collected and G360 retries just the limited reports a few minutes later, on its own.
The client secret is stored encrypted.

Troubleshooting

Test Connection fails

Check each of these, then click Test Connection again:

The Tenant ID and Client ID are from the app’s Overview page, and the secret is the Value, not the Secret ID.
The secret has not expired (Certificates & secrets shows its expiry date).
Reports.Read.All and User.Read.All are added as Application permissions and show Granted (step 3).
The app registration still exists and is enabled.

Save fails with "already exists"

Another connection already uses this Connection Name: choose a different name.
Another connection already uses the same tenant, client ID, and secret: edit the existing one instead.

Save, edit, or delete is refused because a sync is running

Wait a few minutes for the sync to finish, then try again.

The dashboard shows no data, or no names

Wait for the first sync to finish.
Remember activity runs about two days behind.
Check the project selected in the Project filter is the connection’s project.
Check concealed names are turned off (step 4).
Check the client secret has not expired.

Some figures are empty

A recommended permission is missing. Click Edit, then Test Connection: the message lists what is missing. Add it (step 3), grant admin consent again, and the next sync fills it in.

Best practices

Use a dedicated app registration for G360.
Grant only the permissions in the table above.
Replace the client secret before it expires.
Name connections after the tenant they read.

​Overview

​Before you start

​Step 1: Register an app in Microsoft Entra ID

​Step 2: Create a client secret

​Step 3: Add the Microsoft Graph permissions

​Step 4: Show real names in Microsoft 365 reports

​Step 5: Add the connection in G360

​Step 6: Check that data arrives

​The Microsoft Teams Connections page

​Edit a connection

​Delete a connection

​How syncing works

​Troubleshooting

​Best practices

Overview

Before you start

Step 1: Register an app in Microsoft Entra ID

Step 2: Create a client secret

Step 3: Add the Microsoft Graph permissions

Step 4: Show real names in Microsoft 365 reports

Step 5: Add the connection in G360

Step 6: Check that data arrives

The Microsoft Teams Connections page

Edit a connection

Delete a connection

How syncing works

Troubleshooting

Best practices